Is erasure of the HDD by an electromagnetic pulse generator death of the HDD?

  • Thread starter Thread starter M Skabialka
  • Start date Start date
M

M Skabialka

An employee working on a secure site with one of our laptops didn't need it
any more. The site IT folks used an electromagnetic pulse generator to wipe
the hard drive while it was out of the laptop, reinstalled it then returned
the laptop to us. Now the laptop says there is no hard drive. Is the drive
permanently dead - or can it be "found"/formatted/etc using any kind of
recovery utility so that the laptop can be reused without having to buy a
new drive?

Mich
 
M said:
An employee working on a secure site with one of our laptops didn't need it
any more. The site IT folks used an electromagnetic pulse generator to wipe
the hard drive while it was out of the laptop, reinstalled it then returned
the laptop to us. Now the laptop says there is no hard drive. Is the drive
permanently dead - or can it be "found"/formatted/etc using any kind of
recovery utility so that the laptop can be reused without having to buy a
new drive?

Mich

I would venture to say that the entire HD is dead. EMP induces
currents in circuits and basically can have the same effect on chips
as static electricity.

Even if the support circuitry wasn't fried, the servo-tracks for head
positioning were possibly erased which will effectively kill the
drive as well.

Carl
 
M Skabialka said:
An employee working on a secure site with one of our laptops didn't need
it any more. The site IT folks used an electromagnetic pulse generator
to wipe the hard drive while it was out of the laptop, reinstalled it
then returned the laptop to us. Now the laptop says there is no hard
drive. Is the drive permanently dead - or can it be
"found"/formatted/etc using any kind of recovery utility so that the
laptop can be reused without having to buy a new drive?

Mich

If the electromagnetic field was strong enough when they degaussed the drive
it could/would render the drive useless. Degaussing of hard drives erases all
data, formatting and the factory installed magnetic servo tracks located on the
hard disc platters.

See section 3 and 3.1:
http://en.wikipedia.org/wiki/Degaussing

--

Brian A. Sesko
Conflicts start where information lacks.
http://basconotw.mvps.org/

Suggested posting do's/don'ts: http://members.shaw.ca/dts-l/goodpost.htm
How to ask a question: http://support.microsoft.com/kb/555375
 
M said:
An employee working on a secure site with one of our laptops didn't need it
any more. The site IT folks used an electromagnetic pulse generator to wipe
the hard drive while it was out of the laptop, reinstalled it then returned
the laptop to us. Now the laptop says there is no hard drive. Is the drive
permanently dead - or can it be "found"/formatted/etc using any kind of
recovery utility so that the laptop can be reused without having to buy a
new drive?

Mich

They probably used a degaussing coil.

An EMP is intended to damage electronics, and is something
different than a degaussing coil. If you were going to use EMP,
you might as well use a sledge hammer. And I don't think an EMP
would erase the platter - placing the platter in another disk
drive would make it recoverable. This would be the wrong tool.

http://en.wikipedia.org/wiki/Electromagnetic_pulse

The ATA command set, has a built-in erasure command.
There is a "fire and forget" capability for the
erasure command. As I understand it (haven't tested this
myself), when the erase command bit is set, the drive will
not respond to external stimulus, until the erase
sequence is completed. If this is what has been used,
I would leave the drive powered for a couple hours,
to allow time for the erase command to complete. Then,
try powering off the laptop, rebooting, then check the
BIOS to see if the drive is detected. It isn't supposed
to respond and give its ID, until the erasure sequence
completes.

http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml

If it has been physically damaged, then it is finished. The
degaussing coil could apply mechanical force to any metals
which have a magnetic component. It could be the level of
vibration in the unit that damaged it, or the head assembly
could have been torn off. And the thing is, degaussing
doesn't guarantee erasure. They should at least have run
DBAN first, or used the secure erase command (letting
it run to completion), before deciding to use the degaussing
coil. They should have just smashed the drive instead, as
bending the platter even a little bit, is supposed to be
sufficient to prevent recovery. But the thing is, something
should be done to remove the original information first,
as it is the combination of only leaving a fringing field
to work with, plus making it difficult to run recovery
equipment (bending, chipping, scratching etc), that makes
the recovery difficult. If you leave the original data
on the platter, with a nice plump field to work with,
then that is making it easier to do the recovery. So
erasure should be one step, before using other means.
Any good procedure (intended to prevent the disk from
being reused) should be a two step process. First
erasure, followed by destruction.

Paul
 
M Skabialka said:
An employee working on a secure site with one of our laptops didn't need
it any more. The site IT folks used an electromagnetic pulse generator to
wipe the hard drive while it was out of the laptop, reinstalled it then
returned the laptop to us. Now the laptop says there is no hard drive.
Is the drive permanently dead - or can it be "found"/formatted/etc using
any kind of recovery utility so that the laptop can be reused without
having to buy a new drive?

I don't think you meant an EMP generator. These are very large and rather
specialist pieces of kit. There are only 3 that I know of in the UK.

I think you meant a very powerful degausser. If successful then it would
render the disc useless as it would remove the low level formatting from the
disc including the firmware that the drive itself uses (this is stored on
the disc - you can hear it load when you first power up the disc), and the
information on the platters that that firmware uses to establish where the
heads are.
 
Firmware is exactly as it implies - code that is held within a chip - not on
the hard drive.

But an emp pulse would likely destroy this also.
 
M Skabialka said:
An employee working on a secure site with one of our laptops didn't need
it any more. The site IT folks used an electromagnetic pulse generator to
wipe the hard drive while it was out of the laptop, reinstalled it then
returned the laptop to us. Now the laptop says there is no hard drive.
Is the drive permanently dead - or can it be "found"/formatted/etc using
any kind of recovery utility so that the laptop can be reused without
having to buy a new drive?

Mich

Test the drive with another machine or USB enclosure.
If the drive won't work, blame these "IT folks".
Anyway, laptop disks are cheap and widely available these days, so finding a
replacement should not be a problem by itself.

--pa
 
Richard Urban said:
Firmware is exactly as it implies - code that is held within a chip - not
on the hard drive.

Arguably, firmware held in a FLASH memory chip isn't really firmware as it
is just as replaceable as the code on a hard drive.
 
M.I.5¾ said:
Arguably, firmware held in a FLASH memory chip isn't really firmware asit
is just as replaceable as the code on a hard drive.

We could argue that back to EPROMs. <grin> But it really is a convention
thing.
 
Wrong. Most drives store firmware on the disk. That, and the fact that most
drives use magnetic servo-tracks to position the heads means that bulk
erasure ruins the drive.
 
Bill in Co. said:
Missed the rest of this thread, but you don't think that that distinction
is important? I do. :-)

In the context - no. A hard drive's 'firmware' is held on the rewriteable
hard disc itself. A (say) CD-ROM's firmware is held in an equally
rewriteable FLASH memory device.
 
M.I.5¾ said:
In the context - no. A hard drive's 'firmware' is held on the rewriteable
hard disc itself.

Is that true? I guess I wouldn't call that "firmware", per se (if you're
talking about the code that is actually written out and stored on the tracks
of the magnetic disk).

But if you're talking about code that isn't stored on the magnetic hard
drive platter itself, but rather on its circuit board, (like in an EEPROM),
I'd classify THAT (and only that) as firmware.

IOW, firmware, at least to me, is always stored somewhere in an IC chip,
which also covers the case below for flash devices, of course.
 
Bill in Co. said:
Is that true? I guess I wouldn't call that "firmware", per se (if you're
talking about the code that is actually written out and stored on the
tracks of the magnetic disk).

But if you're talking about code that isn't stored on the magnetic hard
drive platter itself, but rather on its circuit board, (like in an
EEPROM), I'd classify THAT (and only that) as firmware.

IOW, firmware, at least to me, is always stored somewhere in an IC chip,
which also covers the case below for flash devices, of course.

I think the problem is that at one time firmware was a very fixed concept,
but these days, the edges have been blurred somewhat.
 
Pedantic hell. I state a fact.

The electronic circuit board that is part of the hard disk drive contains
the drives firmware in an eprom! This is why you can flash a new firmware to
correct for errors when a manufacturer issues the firmware update.

http://www.databe.com/articles/article4.html

Firmware IS NOT contained on the drive platters in any way, shape or form!
 
Richard Urban said:
Pedantic hell. I state a fact.

The electronic circuit board that is part of the hard disk drive contains
the drives firmware in an eprom! This is why you can flash a new firmware
to correct for errors when a manufacturer issues the firmware update.

http://www.databe.com/articles/article4.html

Firmware IS NOT contained on the drive platters in any way, shape or form!

You can't 'flash' firmware into an EPROM. I have checked several hard disc
drives and not one contains an EPROM on it (even very old 10 MB drives).
The absence of a chip with a quartz window on it is the give away.

Any modern drive permits the 'firmware' on the drive to be replaced.

'Matching the code' as your reference puts it is marketing bullshit. If the
firmware on the drive is corrupt, the disc won't start.
 
M.I.5¾ said:
You can't 'flash' firmware into an EPROM. I have checked several hard disc
drives and not one contains an EPROM on it (even very old 10 MB drives).
The absence of a chip with a quartz window on it is the give away.

Any modern drive permits the 'firmware' on the drive to be replaced.

'Matching the code' as your reference puts it is marketing bullshit. If the
firmware on the drive is corrupt, the disc won't start.

Really ? I picked up the first drive I could lay my hands on.

Seagate ST380011A IDE 80GB and it has a 25P05AV on it. I needed a
magnifying glass to get the part number off it.

http://media.digikey.com/photos/Numonyx - Intel/M25P05-AVMN6T.JPG

Look next to the controller chip, for an 8 pin DIP. It is an
EEPROM (electrical erasable) with a serial SPI interface.

http://search.digikey.com/scripts/DkSearch/dksus.dll?Detail&name=497-1621-1-ND

(PDF datasheet here. Can't find it on st.com or Numonyx.)

100,000 Erase/Program Cycles.

http://www.alldatasheet.com/datasheet-pdf/pdf/22812/STMICROELECTRONICS/M25P05-AV.html

Either a controller has EEPROM inside, or in this case, a pretty small
chip next to the controller, has the goods. The space is 64K x 8
or 64KB (512 kilobit), which is plenty to code up either a bootstrap loader
or to hold an entire controller code. Twenty years ago, we did this
in 4KB (and we had room left over). So I don't see 64KB being a problem,
either way (bootstrap or the whole thing). There is no GUI and no .NET in there :-)

This doesn't resolve your current discussion, about what is
held on "track -1", so carry on debating... There are web pages
that discuss the contents of that area of the platters, but who
do you believe. The story could easily change with each generation
of disk. What was true yesterday, could be false tomorrow.

You can get 8 pin DIP flash with 2MB storage. So there are
bigger ones if needed. The 64KB size found on my disk drive,
is also used on video cards to hold the VESA BIOS. 128KB chips
are used on Macintosh versions of video cards. So those little
chips have been around. I flash upgraded my Mac video card with
128KB chip, to run in a PC as the video card. I'm typing on that
video card right now :-)

Paul
 
Paul said:
Really ? I picked up the first drive I could lay my hands on.

Seagate ST380011A IDE 80GB and it has a 25P05AV on it. I needed a
magnifying glass to get the part number off it.

http://media.digikey.com/photos/Numonyx - Intel/M25P05-AVMN6T.JPG

Look next to the controller chip, for an 8 pin DIP. It is an
EEPROM (electrical erasable) with a serial SPI interface.

So not an EPROM then (no erase window)
http://search.digikey.com/scripts/DkSearch/dksus.dll?Detail&name=497-1621-1-ND

(PDF datasheet here. Can't find it on st.com or Numonyx.)

100,000 Erase/Program Cycles.

It's not an EEPROM either. It's actually a FLASH memory chip and not a very
large one at that. Not really large enough to hold drive firmware (by
today's standards) but amply large enough to hold the drive parameters that
tell the rest of the controller how this drive is different to the others in
the range.
http://www.alldatasheet.com/datasheet-pdf/pdf/22812/STMICROELECTRONICS/M25P05-AV.html

Either a controller has EEPROM inside, or in this case, a pretty small
chip next to the controller, has the goods. The space is 64K x 8
or 64KB (512 kilobit), which is plenty to code up either a bootstrap
loader
or to hold an entire controller code. Twenty years ago, we did this
in 4KB (and we had room left over). So I don't see 64KB being a problem,
either way (bootstrap or the whole thing). There is no GUI and no .NET in
there :-)

This doesn't resolve your current discussion, about what is
held on "track -1", so carry on debating... There are web pages
that discuss the contents of that area of the platters, but who
do you believe. The story could easily change with each generation
of disk. What was true yesterday, could be false tomorrow.

If you have an old, but working, redundant drive that you no longer have a
use for, take the cover off the hard drive part. Now if you power it up,
you can watch the read/write head reading the 'firmware' off the drive
platters before the drive is available for use. If you put a 'scope on the
output of the sense amplifier (assuming you can find it) you can see the
code being read.
 
M.I.5¾ said:
If you have an old, but working, redundant drive that you no longer have a
use for, take the cover off the hard drive part. Now if you power it up,
you can watch the read/write head reading the 'firmware' off the drive
platters before the drive is available for use. If you put a 'scope on the
output of the sense amplifier (assuming you can find it) you can see the
code being read.

We can't really answer the question with any certainty, if the docs
for the chips aren't available for public consumption. I took the
nine digit number off my hard drive microcontroller chip, and that
didn't dig up any docs. A site called hddworld had a variety of
nine digit number chips listed. I also found some web sites dealing
in left over inventory, who seemed to have some of them. If they were
custom ROM masks, they shouldn't have escaped into the hands of jobbers.

It could be, that these are mask ROM chips. Could be. There is no
way to know for sure, unless ST.com (SGS Thompson) admits to making them in
some way.

A 64KB EEPROM would be big enough to hold a bootstrap code.
Or a bootstrap could be held inside the microcontroller, in
mask ROM (where only the top mask need be applied to establish
a bit pattern, when manufacturing them). I don't see an easy way
to prove this one way or another, due to the lack of public
documentation.

So what can I say ?

1) I'll assume there is a general purpose micro inside the
controller chip. This gives maximum flexibility in any case.
There is no benefit to making the thing entirely hard wired
logic, especially as the ATA command set is complex, and
a programmable device gives the flexibility needed to interpret
those commands.

2) A microcontroller cannot run without *some* code. The code
cannot be fetched entirely from the platter. The microcontroller
doesn't know how to program the motor controller IC, to start
accelerating the platter. So some code is needed prior to
reading the first byte off the platter.

3) At least some initial code ("bootstrap" code) should be stored
on the PCB. On one of my broken hard drives, where the heads were
gone, the microcontroller reported a hard drive model of "Falcon"
and said my drive was "10GB". In fact the drive had a proper model
number (a Maxtor drive), and the capacity was 40GB. So the PCB
itself was responsible for reporting "Falcon" and "10GB".
That to me suggests that some code is stored on the PCB. In terms
of technology choices, mask ROM inside the chip could be used
to store an initial program. Or, an SPI chip (similar to those
used on the newest motherboards), could be used. But without
some docs, I don't see a way to say definitely how it is done.

(Picture of one of those 9 digit ST chips.)

http://www.techarp.com/showarticle.aspx?artno=302&pgno=3

(An instance of Maxtor and "Falcon". Sure, this says code is stored
in the system area. I don't argue that it isn't possible. But something
must be used to prepare the microcontroller to be able to read the
system area, and that means bootstrap code on the controller board
itself.) And 64K is enough to do that.

http://www.easyrecovery.ie/datarecovery/hdd/maxtor/40GB+ATA+133+HDD.html

If the 64KB device was used for parameter storage

1) It is a slow part, with a serial interface. If you were storing
parameters in it, you might not have power long enough to finish.

2) If it has 100K cycle write rating, and the disk has a minimum
50000 start/stop cycle rating, you run the risk of wearing it
out, if it is written each time the drive was powered. The industry
boiler plate rating is 50000 cycles, meaning most drives can
complete more cycles than that.

It makes more sense for it to hold code, or relatively static
parameters. Things like bad blocks, make more sense to hold in
the system area (track -1).

Paul
 
Back
Top